JSTL的标签

Writing a JSP page, what exactly does the <c:out> do? I've noticed that the following both has the same result:

写一个JSP页面中,< c:out >是什么做的吗?我注意到以下两个有相同的结果:

<p>The person's name is <c:out value="${person.name}" /></p><p>The person's name is ${person.name}</p>

5 个解决方案

#1

145

c:out escapes HTML characters so that you can avoid cross-site scripting.

c:out转义HTML字符，这样可以避免跨站点脚本。

if person.name = <script>alert("Yo")</script>

如果person.name = <脚本> 警报(哟)< /脚本>

the script will be executed in the second case, but not when using c:out

脚本将执行在第二种情况下,而不是在使用c:

#2

117

As said Will Wagner, in old version of jsp you should always use c:out to output dynamic text.

正如Will Wagner所说，在旧版本的jsp中，您应该始终使用c:out来输出动态文本。

Moreover, using this syntax:

此外,使用这种语法:

<c:out value="${person.name}">No name</c:out>

you can display the text "No name" when name is null.

当名称为空时，可以显示文本“无名称”。

#3

c:out also has an attribute for assigning a default value if the value of person.name happens to be null.

c:out还有一个属性，如果person的值为null，那么就会分配一个默认值。

Source: out (TLDDoc Generated Documentation)

来源:out (TLDDoc生成的文档)

#4

You can explicitly enable escaping of Xml entities by using an attribute escapeXml value equals to true. FYI, it's by default "true".

可以通过使用属性escapeXml值= true显式地启用Xml实体转义。顺便说一下，这是默认的“true”。

#5

Older versions of JSP did not support the second syntax.

旧版本的JSP不支持第二个语法。

#1

145